Just posing some questions to think about, I am not well-versed in the specifics of setting up this configuration on APM.
- You are taking the first header in the list of potential X-Forwarded-For headers present, and then taking the first IP address from that header, correct? Is that always desired state?
- What event is that logic applied in?
- Also you have one-connect enabled? If not, you're evaluating on a per-connection basis, not a per-request basis.
- Finally, have you taken packet captures to evaluate your headers ahead of and after BIG-IP?
Nimbostratus
